CVE-2020-11651

SaltStack Salt is used to manage servers automatically. This vulnerability lets someone connect from the network without logging in and potentially trigger “restricted” actions—like grabbing authentication tokens from the Salt master or running commands on servers that the master manages, similar to bypassing the locked door in an office and using it to open other rooms.

This matters if your business runs SaltStack Salt, particularly the salt-master process that coordinates and tells other machines what to do. It’s a risk when the vulnerable access path is reachable from the network, and the attacker does not need a login. If the service is not exposed to the network, risk may be lower, but reachability in your environment is not confirmed by the available findings—verify exposure.

This is RED because CISA has confirmed this issue is in active, real-world risk management (it’s on the CISA KEV list). There is also public exploit availability, and the vendor fix exists—so the correct response is to patch without delay rather than wait for additional signals.

Confirm exposure

• Determine whether you run SaltStack Salt and whether the salt-master process is in use.
• Identify the Salt version you run (exact version string).
• Check network exposure: whether the salt-master service can be reached from untrusted networks (for example, from the public internet or other external networks). The findings do not confirm default exposure, so your environment controls the risk.

Check if you’re affected

• You are affected if your SaltStack Salt version is before 2019.2.4 or before 3000.2, as described in the finding.

Upgrade to the fix

• If you are on the Salt release line that maps to the PyPI package named salt, upgrade to 2019.2.4 or later.
• If you are on the 3000 release line, upgrade to 3000.2 or later.
• Follow the vendor’s upgrade steps and restart the salt-master after the upgrade.

If patching is delayed (temporary containment)

• Restrict network access to the salt-master so it is not reachable from untrusted networks.
• Ensure only trusted systems/networks can reach the salt-master endpoints.
• Increase monitoring of salt-master logs for unusual method calls or unexpected authorization/token access patterns (exact indicators depend on your Salt configuration).

What to monitor after upgrading

• Confirm the salt-master is running the upgraded version.
• Review salt-master logs for failed or suspicious requests immediately after the change.
• Validate that managed minions still receive commands normally from the updated master.

CISA timing

• CISA due date for required remediation (from KEV): 2022-05-03.

CVE-2020-11651 (SaltStack Salt) is a critical, unauthenticated remote issue affecting the salt-master “ClearFuncs” class method-call validation. The mechanism is that the salt-master does not properly validate restricted method calls, allowing remote attackers to invoke sensitive functions without authentication. Based on the findings, this can enable theft of user tokens from the salt master and/or execution of arbitrary commands on salt minions.

Status/coverage signals from findings:

• KEV (CISA): Yes; listed 2021-11-03 with remediation due 2022-05-03.
• Exploitation: public exploit available (2 known) and sustained press attention.
• Exploit maturity: weaponization confirmed via the exploit finding.
• Predicted likelihood (EPSS): provided by findings, but public blocks should not rely on it for urgency because KEV/public exploit presence already establishes real-world risk. (The verdict here is therefore treated as confirmed urgency.)